OWASP Global AppSec USA 2026: Full Schedule

10:30am PST

So your developers hate you... How to turn reluctant devs into AppSec champions

Thursday November 5, 2026 10:30am - 11:15am PST

Committing to creating and managing an AppSec program is hard, and it's only made harder by our most beloved clients and teammates, reluctant developers. Developers who have typically enjoyed a life free of security concerns, managing their own work and shipping features on their timescale. It is, perhaps, understandable that adding security controls leads to friction and pain for our developers. Security often suddenly changes how they work! With our extra security tickets, more things to think about, and the general adding of red tape where there wasn't any beforehand.

Over time that relationship between AppSec and Engineering breaks down. Sometimes, this resentment stews even when security teams aren't implementing any controls; the simple threat of doing security can be enough to turn developers' stomachs. Losing the battle on bugs, before it's even begun in earnest.

So how can we convince devs that we're not out to get them? Or make their life harder? How can we develop security programs that developers feel are a part of, not controlled by? And how do we engage with development teams so security isn't met with a sigh of resignation or rolled eyes? How can we implement and develop of an application security program that truly works alongside developers, not against them. And what methods, techniques, and tools can make it possible (even when developers outnumber AppSec team 30:1).

Speakers

Dr. Katie Paxton-Fear

Lecturer and Educational YouTuber, Manchester Metropolitan University

Dr Katie Paxton-Fear is a lecturer of cyber security at Manchester Metropolitan University, she's a hacker and YouTuber, she's made 50+ videos on a range of topics, explaining vulnerabilities, tools etc, and made a splash as an API hackerSpeaker Agreement
@InsiderPhD
lin... Read More →

Thursday November 5, 2026 10:30am - 11:15am PST
Room: Bayview B (Bay Level)

Process and Culture

Audience Intermediate

11:30am PST

How Security Champions can keep AI-driven software safe

Thursday November 5, 2026 11:30am - 12:15pm PST

Room: Bayview B (Bay Level)

AI tools are supercharging the speed at which development teams ship software. Developers are no longer just copy-pasting code snippets; they are using AI agent frameworks to automate multi-step engineering tasks. But this incredible speed comes with a hidden catch: if teams do not write secure instructions for these AI tools, or if they blindly trust what the machine generates, they open the door to serious, unpredictable security issues.

Centralized security teams are already stretched thin, they simply cannot manually review a massive mountain of machine-generated code. Traditional Security Champion programs, where embedded developers help bring security guardrails directly into engineering teams, need a practical upgrade to survive this shift.

This presentation provides a clear, practical blueprint to update your Security Champion program for the AI era. Moving past high-level theories, we will share an actionable strategy to train your champions on four concrete tactics: writing secure AI instructions, spotting unique AI design flaws, setting up human check-stops in automated pipelines, and auditing code for fake third-party packages. Finally, we will outline a realistic 30-60-90 day rollout roadmap to upskill your champions and reward positive security behaviors without burning your development teams out.

Speakers

Stanley Harris

CEO and Co-Founder, Katilyst

Stanley is the CEO and Cofounder of Katilyst, where he leads initiatives to build and enhance Security Champion programs. With over 15 years of experience in organizational change management, he has successfully designed and launched multiple Security Champion programs, fostering... Read More →

Thursday November 5, 2026 11:30am - 12:15pm PST
Room: Bayview B (Bay Level)

Process and Culture

Audience Intermediate

1:15pm PST

Enterprise AppSec That Scales Itself

Thursday November 5, 2026 1:15pm - 2:00pm PST

Room: Bayview B (Bay Level)

Every enterprise security team knows the math doesn't work. You have a thousand applications in your environment. Your team can comprehensively assess maybe sixty a year, and can only onboard a subset of that to the industry standard tools. Configuration drifts the moment you look away, integrations multiply in the dark, and by the time you circle back to re-assess an app, the environment has changed so drastically that you're starting from scratch. You are perpetually behind, and the bad actors know it.

This talk is the story of how we stopped trying to win a losing game and built something different. We designed an autonomous application security program that uses AI-driven assessments, machine & human generated institutional knowledge, and self-accumulating drift detection to evaluate our most critical applications continuously, ensuring we find real security issues. We'll walk through the thinking that got us here, the moment we accepted that the current industry methodology would never cover the portfolio, the design principles we committed to, the lessons we learned along the way, and how other security teams can implement this in their own environments.

Speakers

Dheven Kara

Enterprise Security Engineer, Palo Alto Networks

Dheven Kara is an Enterprise Security Engineer at Palo Alto Networks where he works on strengthening security across large-scale enterprise environments. His background combines hands-on security engineering with a practical understanding of how organizations manage risk, improve... Read More →

Kailey Stauble

Enterprise Security Engineer, Palo Alto Networks

Kailey Stauble is an Enterprise Security Engineer at Palo Alto Networks where she works on strengthening security across large-scale enterprise environments. Her background combines hands-on security engineering with a practical understanding of how organizations manage risk, improve... Read More →

Thursday November 5, 2026 1:15pm - 2:00pm PST
Room: Bayview B (Bay Level)

Process and Culture

Audience Intermediate

2:15pm PST

The attacker does not sort by CVSS

Thursday November 5, 2026 2:15pm - 3:00pm PST

Room: Bayview B (Bay Level)

Your backlog has a sorting problem.

The CVSS 9.1 chain gets the oxygen. The ugly old login flow gets a shrug. The weird admin route nobody owns gets pushed to next quarter. Then the attacker shows up and picks the boring path, because boring is cheap, quiet, reusable, and good enough.

That's the gap this talk is about. CVSS tells you how bad exploitation can be. EPSS and KEV tell you what is being exploited, or likely to be exploited, somewhere in the world. OWASP Risk Rating helps reason about likelihood and impact. Those are useful inputs, but your sprint still needs a sharper local question: for this system, with these defenses, which complete path would an attacker choose first?

I built Capability Trees for that argument. It's a small open-source CLI and rubric that ranks complete attack paths, not isolated bugs. For each path, you score five things: acquisition cost, detection risk, reusability, required skill, and payoff. The number isn't magic. The point is to make the tradeoff explicit enough that security and engineering can stop arguing from vibes.

I'll run it live on an anonymized multi-tenant SaaS backlog. In that worked example, the scary CVSS 9.1 billing chain drops to last. Credential stuffing and a cross-tenant IDOR jump into the top tier. I won't ask you to trust the reorder because a formula said so. I'll walk the economics until the boring path feels obvious in hindsight. Then I run the sensitivity check on stage, because the honest question is obvious: did I just tune the weights until the demo looked good?

Sometimes the ranking holds. Sometimes it wobbles, and the tool tells you to slow down. Either outcome is useful. You leave with the tool and a one-hour way to run this with your own engineers on Monday.

Speakers

Hugo Guillaume

Security Engineer, Konvu

Hugo Guillaume is a security researcher. He spent close to three years on offensive and defensive security research in a government national-defense setting, doing vulnerability research and reverse engineering and building automated bug-discovery systems. He also teaches cybersecurity... Read More →

Thursday November 5, 2026 2:15pm - 3:00pm PST
Room: Bayview B (Bay Level)

Process and Culture

Audience Intermediate

3:30pm PST

No value until it’s fixed: turning security reviews into a remediation loop

Thursday November 5, 2026 3:30pm - 4:15pm PST

Room: Bayview B (Bay Level)

A CISO once told me “your security review doesn’t deliver value until the findings are fixed.” That changed how I think about security reviews. They shouldn’t end at identifying issues and handing developers a list of things to consider. They should continue into a security improvements loop that actually drives the fixes. For a finding to be actionable, it needs implementation guidance for the tech stack actually in use, and it has to comply with the organization’s own policies and frameworks.

This talk breaks that down, first at the level of a single review. It starts with context, because context decides which requirements apply: how the software is deployed and exposed, who uses it, what data it processes, and what it must comply with. From there I look at getting rid of false positives, and why “false positive” is rarely a clean boundary. Some reviewers might raise that an input field must be sanitized for HTML, while a sharp developer might say it should be handled by output encoding - the real question is where the control belongs.

I then cover what “implemented” actually means, using acceptance criteria generated from the same requirements to judge whether a control is in place or still needs work. And because the output of this loop is code changes rather than a report, it has to integrate with the review and testing pipeline like any other change.

The second half moves to the program level, where org-specific context and requirements can’t be set per review but evolve with the AppSec program. I’ll cover capturing company standards (your way of doing rate limiting, how you store M2M credentials), keeping an audit trail for compliance, and measuring progress with metrics you can act on: number of code changes, requirements secured from scratch, fix rate, and time to remediate. I’ll also take a position on where penetration testing fits once this loop is running well, and why pen testing is more likely to be reshaped by this data than replaced by it.

Security reviews in the agentic era hold completely new opportunities. What was always a scaling problem becomes a matter of fine-grained details that agents can work through at scale, and what used to end in ad-hoc results can finally turn into improvements available immediately. This is how security reviews start delivering the business value we’ve always claimed for them, instead of just adding to a developer’s todo list.

Key takeaways:
- A security review shouldn’t end at findings. Its value is the fix, so the goal is a security improvements loop that drives changes, not a report that lists risks and leaves developers with more todos.
- “False positive” is rarely a clean boundary. Often the question isn’t real-or-not but where a fix belongs and whether it’s warranted in this context, and that judgment, grounded in proper context, is the actual work.
- “Implemented” has to be measurable, not guessed. Acceptance criteria generated from the same requirements are what you assess a control against, so “done” means the same thing to the developer and the reviewer.
- At program level, measure what you can act on, and rethink where pen testing fits. Track code changes, requirements secured from scratch, fix rate, and time to remediate; and once the loop runs well, the data it produces points toward the next generation of pen tests rather than away from them.

Speakers

Emil Kvarnhammar

Co-Founder and CEO, Oplane

Emil Kvarnhammar has spent 27 years in software, starting as a developer before moving into cybersecurity consulting and, later, security architecture for a leading video-surveillance manufacturer. Across multiple AppSec programs he has worked hands-on with SAST, SCA, security testing... Read More →

Thursday November 5, 2026 3:30pm - 4:15pm PST
Room: Bayview B (Bay Level)

Process and Culture

Audience Intermediate

10:30am PST

From IC to Leader: A Field Guide to Building High-Performing Security Teams

Friday November 6, 2026 10:30am - 11:15am PST

Room: Bayview B (Bay Level)

Most security leaders are exceptional technologists, but building and managing a high-performing security team requires an entirely different skill set - one that is rarely taught and almost never documented. This talk closes that gap.

Drawing on 20+ years spanning Big 4 consulting, multiple security org builds from scratch, and security leadership roles across fintech, banking, and SaaS, this expanded session delivers a comprehensive, practitioner-tested playbook for security team leadership.

Attendees leave with actionable frameworks across the full leadership lifecycle: crafting job descriptions that attract elite talent, structured onboarding plans that accelerate time-to-contribution, Agile practices purpose-built for security teams, performance management grounded in four concrete pillars, a live case study walking through how these frameworks interact in practice, and managing up to executives with clarity and confidence.

Beyond the operational mechanics, the talk addresses the human dimensions of leadership that often go unspoken: building psychological safety, navigating conflict, developing a culture of continuous learning, and supporting team well-being to prevent burnout, a persistent challenge in a high-pressure field.

Whether you are a first-time security manager, a seasoned CISO, or a practitioner preparing to lead, this session delivers real-world guidance, not theory. Every framework presented has been used in production at companies ranging from 10-person startups to public companies. Come prepared to take notes, the slides include reusable templates you can apply to your team on Monday.

Speakers

Anshu Gupta

Founder, Fixin Security

Anshu Gupta is a seasoned global cybersecurity executive with Fortune 500 advisory experience at EY and KPMG, working with companies including Microsoft, Salesforce, Cisco, and Adobe. He has built and led security programs at high-growth startups and fintechs, including Coupa, HelloSign... Read More →

Friday November 6, 2026 10:30am - 11:15am PST
Room: Bayview B (Bay Level)

Process and Culture

Audience All

11:30am PST

Shadow AI is the new Shadow IT

Friday November 6, 2026 11:30am - 12:15pm PST

Room: Bayview B (Bay Level)

Decades ago we identified Shadow IT as a major cybersecurity risk, and we realized that we can't secure what we don't see. As history likes to repeat itself, we are now back in exactly the same place with AI. And we are in a race against time, as currently AI adoption in most organizations is moving faster than their ability to govern it. This talk aims to shift the paradigm from AI as primarily a technology risk, to it being a governance challenge. And in doing so, to offer the audience a pragmatic, risk-based approach to governing AI without slowing innovation. We will visit current threats and emerging frameworks that can already be applied for bringing AI risk back under control. Because when an organization will have an AI security incident, the CISO will not have to answer about the AI technical failures, but rather about the lack of governance around it.

Speakers

Sebastian Avarvarei

Consulting CISO & Leadership Development Coach

With over 20 years of experience in cybersecurity at both strategic and operational levels, and a proven track record of building high-performing security teams, Sebastian takes a multi-faceted view on today's security challenges, successfully blending technical acumen with business... Read More →

Friday November 6, 2026 11:30am - 12:15pm PST
Room: Bayview B (Bay Level)

Process and Culture

Audience Intermediate

1:15pm PST

Why Developers Can and We Can't: Making Security Findings That Agents (and Humans) Can Act On

Friday November 6, 2026 1:15pm - 2:00pm PST

Room: Bayview B (Bay Level)

Coding agents went from novelty to daily driver in less than three years. Developers are now using AI to generate, test, and ship code as part of their normal workflow. But the way security communicates guidance has barely changed: findings buried in long documents, review comments that arrive after key decisions are already made, and requirements that are too vague for a developer to act on — let alone a coding agent.

The issue is not that developers do not care about security. It is that security intent often never reaches them in a form they can actually use.

So why did AI change the engineering workflow so quickly, while security reviews still look the same?

This talk looks at the structural reason behind that gap. Coding agents can only act on guidance that is specific, contextual, and executable. Most threat models and design review findings do not meet that bar. We will look at where review output breaks down in practice: findings that are technically true but not relevant, likelihood ratings that drift from reality, recommendations that are impossible to implement, and issues that no one knows how to translate into engineering work.

A human developer may be able to interpret a vague finding and make a judgment call. A coding agent will not. It will simply keep building without the missing security intent.

The second half of the talk focuses on what to do about it. We will present a practical framework for turning security review output into findings that are grounded in the real architecture, aware of existing controls, scoped to threats that actually apply, and written in a way that developers can act on.

Attendees will leave with a framework they can apply to their own design review or threat modeling process immediately, along with quality signals for measuring whether security findings are accurate, useful, and actually acted on.

Speakers

Hai Maler

Head of Research, Clover Security

Hai Maler is Head of Research at Clover Security, where he drives research that brings advanced AI capabilities into practical product security workflows. He brings over 10 years of industry experience, from breaking systems and studying how they fail to building tools that help defenders... Read More →

Friday November 6, 2026 1:15pm - 2:00pm PST
Room: Bayview B (Bay Level)

Process and Culture

Audience Intermediate

2:15pm PST

From Consuming to Contributing: How We Built the Space That Was Missing

Friday November 6, 2026 2:15pm - 3:00pm PST

Room: Bayview B (Bay Level)

Many of us naturally drift from consuming OWASP resources to contributing to them. At some point you stop just reading the Top 10 and start showing up at a chapter, submitting a pull request, or volunteering at a conference. But what often gets lost is the "together" part. The shared strategy, the mutual encouragement, a place where experienced contributors can mentor others and people new to contributing can find their footing without having to figure it out alone.

It started when two of us ran into each other at the Boston Application Security Conference. Same organization, same department, had no idea the other was there. That conversation grew into three people, then a cross-regional group, and eventually an initiative with executive sponsorship built around a simple question: what if there was a structured space where people at all levels of OWASP engagement could come together, share what they know, coordinate where to show up, and help each other go deeper?

That is what we built. A space where seasoned contributors have a home for their work and a way to pass it on, and where people curious about OWASP but not sure where to start can learn, get mentored, and take their first real steps. Contribution gets tracked, progress gets shared, and the work gets recognized internally in ways it never was before.

In this talk we share our journey, what the initiative looks like in practice, what we have achieved together so far, and what you can take back to your own organization.

Speakers

Saquib Saifee

AI Security Engineer, IBM

Saquib Saifee is an AI Security Engineer at IBM working at the intersection of AI security, software supply chain security, and offensive security. He contributes to the OWASP GenAI Security Project on securely using and building MCP servers, participates in the Linux Foundation AI... Read More →

Caroline Lee

Secuirty Engineer, IBM

Caroline is based out of Boston, Massachusetts, and works as a Security Engineer at IBM in CISO Remediation. She holds a Masters in Computer Science with a Specialization in Cybersecurity.
Previously, she has worked on CICD, Application Security, and Cloud Security initiatives in... Read More →

Gaurang Deshpande

Software Developer, Cyber Defense, IBM

linkedin.com/in/gaurang-deshpande

Friday November 6, 2026 2:15pm - 3:00pm PST
Room: Bayview B (Bay Level)

Process and Culture

Audience All

3:30pm PST

Breaking the Headcount Scaling Model: How GitLab's Product Security Teams Achieved Non-Linear Securi

Friday November 6, 2026 3:30pm - 4:15pm PST

Room: Bayview B (Bay Level)

Complete title that is cut by "Session Title" size limit: Breaking the Headcount Scaling Model: How GitLab's Product Security Teams Achieved Non-Linear Security Gains with AI

Engineering ships faster every quarter with AI assisted development, Security headcount grows slowly and the review backlog keeps growing at a rate you wish you didn’t know! This talk traces the struggles of building an AppSec function from scratch, through the scaling pain of supporting a fast-growing engineering organization, to the entirely new class of challenges created by the rise of AI-assisted software development.

And it starts with the pain. Building an AppSec function inside a fast-growing engineering org means years of playing catch-up: hiring into a market with a shortage of talent, onboarding people who take months to become productive and sitting at a security engineer-to-developer ratio of 1 to 2%(and 2& when you’re lucky!) that never meaningfully improves. Somewhere along the way, it can become the team that slows things down and that’s when engineering teams no longer want you onboarded and be part of their workflow.

Then AI changed the game much faster than anticipated and in ways we did not plan for: engineering velocity jumped, AI-generated code brought volumetric challenges at the “diff” level as well as at scale. And teams started building features on top of AI. This creates threat surfaces that weren’t present before and that threat actors have leveraged extensively since the beginning of the year. We are now fighting on two fronts: securing AI-powered features while keeping up with AI-accelerated development speed.

This talk covers how we responded with AI-powered (and non AI-powered) automations, and which hard decisions we had to take to enable those improvements to happen. We will explain the change in how we had to think about the solutions to match not only human expectations, but also work with AI-powered tools as well as the capacity cost of building these tools. We will also cover some of the challenges we faced (and are still facing) when we had to leverage AI solutions and how we think our team will evolve in the coming months.

Speakers

Vitor Meireles

Senior Security Engineering Manager AppSec, GitLab

Vitor Meireles is a security professional with over 15 years of experience in the field. Currently serving as a Senior Security Engineering Manager at GitLab, he helps engineering teams build applications that are secure by design. Vitor has past experiences in the consulting, financial... Read More →

Friday November 6, 2026 3:30pm - 4:15pm PST
Room: Bayview B (Bay Level)

Process and Culture

Audience Intermediate

10:30am PST

11:30am PST

1:15pm PST

2:15pm PST

3:30pm PST

10:30am PST

11:30am PST

1:15pm PST

2:15pm PST

3:30pm PST

Get help with the event